Information Security Policy
Objectives
FinTrack protects the confidentiality, integrity, availability, and lawful handling of information. Controls are selected according to data sensitivity, business criticality, threat, and contractual requirements. Security is a shared responsibility across management, engineering, operations, providers, and authorised users.
Mandatory controls
| Domain | Requirement |
|---|---|
| Governance | Assign accountable owners, maintain a risk register, review controls, and approve exceptions with expiry dates |
| Asset and data management | Inventory systems and providers; classify, minimise, retain, and dispose of data according to purpose |
| Access control | Use named identities, least privilege, MFA for privileged provider access, periodic reviews, and prompt revocation |
| Secure development | Apply security requirements, review, controlled changes, verification, secret protection, and vulnerability response |
| Infrastructure | Use supported managed services, secure configuration, encrypted transport, monitoring, backups, and recovery planning |
| Operations | Manage patches, vulnerabilities, logs, incidents, suppliers, and changes through documented processes |
| Privacy | Process personal data for defined purposes, limit disclosure, protect data-subject rights, and investigate breaches |
| Assurance | Retain evidence, disclose limitations accurately, and never treat an unavailable test as a pass |
Roles
- Management accepts residual risk and provides resources.
- Technical operations own service configuration, availability, recovery, and privileged access.
- Engineering owns secure design, implementation, dependency, and change evidence.
- Data and business owners define purpose, access, retention, and disclosure requirements.
- All users protect credentials and promptly report suspected incidents.
Exceptions and enforcement
Exceptions require a business reason, risk assessment, compensating controls, accountable approver, and expiry date. Suspected violations are investigated under the incident process. Access is suspended to protect systems and evidence. Material policy changes and overdue exceptions are reported to accountable management.
Control governance cycle
| Activity | Frequency or trigger | Accountable output |
|---|---|---|
| Asset and provider inventory | At least annually and before introducing a material service | Owner, purpose, data class, criticality, provider, and lifecycle state |
| Risk review | At least annually and after a material architecture, threat, incident, or regulatory change | Risk statement, likelihood, impact, treatment, owner, due date, and residual-risk decision |
| Access review | Quarterly for privileged provider access and at the approved cadence for application roles | Membership comparison, excessive-access removals, dormant-account actions, and approver evidence |
| Vulnerability review | Continuous intake with severity-based treatment targets | Finding, affected asset, owner, due date, exception, remediation, and retest evidence |
| Supplier review | Before onboarding, annually, and after a material provider incident or service change | Due diligence, processing terms, region, security evidence, contacts, and exit decision |
| Recovery exercise | At the approved continuity cadence and after material recovery changes | Scenario, recovery point, elapsed time, validation, reconciliation, and corrective actions |
| Incident exercise | At least annually and after material response-process changes | Participants, decisions, measured response, communication result, gaps, and owners |
| Policy review | At least annually and after material legal, contractual, or technical change | Approved revision, owner, effective date, affected procedures, and acknowledgement plan |
Information classification
| Class | Example | Handling rule |
|---|---|---|
| Public | Approved product and assurance information | Disclosure follows content, privacy, and security review |
| Internal | Operating procedures, non-sensitive architecture, and routine business material | Limited to personnel and providers with a business need |
| Confidential | Customer, policy, workforce, commercial, and detailed security information | Named access, encryption in transit, controlled storage, minimized disclosure, and retention rule |
| Restricted | Credentials, privileged configuration, cryptographic material, sensitive identity evidence, and high-impact security findings | Strongest available access controls, no public or browser exposure, explicit custody, monitoring, and emergency revocation |
Review position
This is the first generated public baseline. Formal corporate approval, named owners, staff acknowledgement, training records, exception register, and control-testing records require separate internal evidence before being claimed.